Description
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| anshulkharb | thumbnail | ≤ 1.5 | — |
References
- https://github.com/anshulkharb/thumbnail/pull/9 patch issue-tracking
- https://github.com/anshulkharb/thumbnail/blob/23b2e30509c936872a3bafac65b4aa48777e794c/thumbnail/thumbnail.py#L100-L114 technical-description
- VulnCheck Advisory: Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths third-party-advisory